In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Fix race of buffer access at PCM OSS layer
The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of sndpcmformatsetsilence() with runtime->dmaarea. But this may lead to a UAF because the accessed runtime->dmaarea might be freed concurrently, as it's performed outside the PCM ops.
For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93a81ca0657758b607c3f4ba889ae806be9beb73",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220153184664492571772166564729750385121",
"302065865848575243204969740677343795392",
"16094191804022574090831597187188856399",
"293894636035660281514658691401521475496",
"285785251699267381857277449746148348208"
]
},
"id": "CVE-2025-38078-00e44da7",
"signature_version": "v1",
"target": {
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf85e49aaf3a3c5775ea87369ea5f159c2148db4",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "100368563545704016390658618352546317616",
"length": 6112.0
},
"id": "CVE-2025-38078-0703f3aa",
"signature_version": "v1",
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74d90875f3d43f3eff0e9861c4701418795d3455",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220153184664492571772166564729750385121",
"302065865848575243204969740677343795392",
"16094191804022574090831597187188856399",
"293894636035660281514658691401521475496",
"285785251699267381857277449746148348208"
]
},
"id": "CVE-2025-38078-0aa9b0f6",
"signature_version": "v1",
"target": {
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0e05a76fc727929524ef24a19c302e6dd40233f",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220153184664492571772166564729750385121",
"302065865848575243204969740677343795392",
"16094191804022574090831597187188856399",
"293894636035660281514658691401521475496",
"285785251699267381857277449746148348208"
]
},
"id": "CVE-2025-38078-0adb3851",
"signature_version": "v1",
"target": {
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf85e49aaf3a3c5775ea87369ea5f159c2148db4",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283976482074791696968544402743471639993",
"330588841378365842225722419783058081083",
"199387604828778541749504963928444326789"
]
},
"id": "CVE-2025-38078-19806493",
"signature_version": "v1",
"target": {
"file": "sound/core/pcm_native.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e14d706ec18faf19f5a6e75060e140fea05d4a",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283976482074791696968544402743471639993",
"330588841378365842225722419783058081083",
"199387604828778541749504963928444326789"
]
},
"id": "CVE-2025-38078-1aa71069",
"signature_version": "v1",
"target": {
"file": "sound/core/pcm_native.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0e05a76fc727929524ef24a19c302e6dd40233f",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "45051561917871241252752957722729036677",
"length": 6303.0
},
"id": "CVE-2025-38078-24f36627",
"signature_version": "v1",
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74d90875f3d43f3eff0e9861c4701418795d3455",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283976482074791696968544402743471639993",
"330588841378365842225722419783058081083",
"199387604828778541749504963928444326789"
]
},
"id": "CVE-2025-38078-264abfca",
"signature_version": "v1",
"target": {
"file": "sound/core/pcm_native.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afa56c960fcb4db37f2e3399f28e9402e4e1f470",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256529473221233847526401991608430783013",
"297950351769476945932608722529138908175",
"248562721653947445200282870045324532168"
]
},
"id": "CVE-2025-38078-3c163bdf",
"signature_version": "v1",
"target": {
"file": "include/sound/pcm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74d90875f3d43f3eff0e9861c4701418795d3455",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "100368563545704016390658618352546317616",
"length": 6112.0
},
"id": "CVE-2025-38078-4b2f3276",
"signature_version": "v1",
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afa56c960fcb4db37f2e3399f28e9402e4e1f470",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220153184664492571772166564729750385121",
"302065865848575243204969740677343795392",
"16094191804022574090831597187188856399",
"293894636035660281514658691401521475496",
"285785251699267381857277449746148348208"
]
},
"id": "CVE-2025-38078-7567697f",
"signature_version": "v1",
"target": {
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0e05a76fc727929524ef24a19c302e6dd40233f",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283976482074791696968544402743471639993",
"330588841378365842225722419783058081083",
"199387604828778541749504963928444326789"
]
},
"id": "CVE-2025-38078-7cac5c60",
"signature_version": "v1",
"target": {
"file": "sound/core/pcm_native.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93a81ca0657758b607c3f4ba889ae806be9beb73",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "100368563545704016390658618352546317616",
"length": 6112.0
},
"id": "CVE-2025-38078-7e825717",
"signature_version": "v1",
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e14d706ec18faf19f5a6e75060e140fea05d4a",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220153184664492571772166564729750385121",
"302065865848575243204969740677343795392",
"16094191804022574090831597187188856399",
"293894636035660281514658691401521475496",
"285785251699267381857277449746148348208"
]
},
"id": "CVE-2025-38078-84bb150b",
"signature_version": "v1",
"target": {
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf85e49aaf3a3c5775ea87369ea5f159c2148db4",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220153184664492571772166564729750385121",
"302065865848575243204969740677343795392",
"16094191804022574090831597187188856399",
"293894636035660281514658691401521475496",
"285785251699267381857277449746148348208"
]
},
"id": "CVE-2025-38078-8dcb4261",
"signature_version": "v1",
"target": {
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0e05a76fc727929524ef24a19c302e6dd40233f",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256529473221233847526401991608430783013",
"297950351769476945932608722529138908175",
"248562721653947445200282870045324532168"
]
},
"id": "CVE-2025-38078-91d4c981",
"signature_version": "v1",
"target": {
"file": "include/sound/pcm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afa56c960fcb4db37f2e3399f28e9402e4e1f470",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "100368563545704016390658618352546317616",
"length": 6112.0
},
"id": "CVE-2025-38078-98c7f59e",
"signature_version": "v1",
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e14d706ec18faf19f5a6e75060e140fea05d4a",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "100368563545704016390658618352546317616",
"length": 6112.0
},
"id": "CVE-2025-38078-9ae3911b",
"signature_version": "v1",
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93a81ca0657758b607c3f4ba889ae806be9beb73",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283976482074791696968544402743471639993",
"330588841378365842225722419783058081083",
"199387604828778541749504963928444326789"
]
},
"id": "CVE-2025-38078-a6ba54f5",
"signature_version": "v1",
"target": {
"file": "sound/core/pcm_native.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afa56c960fcb4db37f2e3399f28e9402e4e1f470",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283976482074791696968544402743471639993",
"330588841378365842225722419783058081083",
"199387604828778541749504963928444326789"
]
},
"id": "CVE-2025-38078-b981c17a",
"signature_version": "v1",
"target": {
"file": "sound/core/pcm_native.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93a81ca0657758b607c3f4ba889ae806be9beb73",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256529473221233847526401991608430783013",
"297950351769476945932608722529138908175",
"248562721653947445200282870045324532168"
]
},
"id": "CVE-2025-38078-be2ec437",
"signature_version": "v1",
"target": {
"file": "include/sound/pcm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf85e49aaf3a3c5775ea87369ea5f159c2148db4",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256529473221233847526401991608430783013",
"297950351769476945932608722529138908175",
"248562721653947445200282870045324532168"
]
},
"id": "CVE-2025-38078-de54b659",
"signature_version": "v1",
"target": {
"file": "include/sound/pcm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e14d706ec18faf19f5a6e75060e140fea05d4a",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256529473221233847526401991608430783013",
"297950351769476945932608722529138908175",
"248562721653947445200282870045324532168"
]
},
"id": "CVE-2025-38078-e1a6cb0d",
"signature_version": "v1",
"target": {
"file": "include/sound/pcm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74d90875f3d43f3eff0e9861c4701418795d3455",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256529473221233847526401991608430783013",
"297950351769476945932608722529138908175",
"248562721653947445200282870045324532168"
]
},
"id": "CVE-2025-38078-f0ba7597",
"signature_version": "v1",
"target": {
"file": "include/sound/pcm.h"
}
}
]